October Risk Barometer

ETHIOPIA | NATO'S EASTERN FLANK | COLOMBIA

In Global Guardian's monthly Risk Barometer, our Intelligence Team highlights current global hotspots with the potential to impact your business operations and travel. Read below for analysis on the threats we are closely monitoring this month and click here to subscribe for regular intelligence updates.

Eritrea's Intervention in Ethiopian Civil War Signals Regional Escalation

Eritrean regular troops conducted a likely reconnaissance in force in northern Ethiopia from 06 to 08 October marking the first direct international involvement in Ethiopia’s growing civil war. Fighting began on 23 September when the Ethiopian Peoples’ Forces Alliance for Survival (EPFAS), a coalition of seven Ethiopian armed opposition groups led by the Tigrayan People’s Liberation Front (TPLF), attacked federal forces across multiple regions. The conflict is now poised to expand through a complex web of interests and actors that permeates the Horn of Africa and Middle East with severe implications for the region’s humanitarian situation, and potential risks to international maritime trade and air travel.

Recommendations

• Global Guardian recommends against all travel to the Ethiopia’s Tigray, Afar, and Amhara regions, including Lalibela, and that both firms and individuals reconsider all non-essential travel to Ethiopia and Eritrea.
• Firms with personnel in Addis Ababa should develop evacuation plans and decide on implementation triggers in advance.
• Firms with presence in Ethiopia should also develop contingency communication systems up to and including the assignment of rally points for personnel in case of no-warning communications shutdowns.
• Personnel currently in Ethiopia should maintain at least half a tank of gas in primary vehicles and assemble essential supplies in case overland evacuation or extended shelter-in-place orders become necessary.
  

Situation Report

Eritrean troops crossed the border into Ethiopia’s Tigray Region at Zelambesa via the B20 highway before moving into the towns of Adigrat and Edaga Hamus on 06 and 07 October respectively. Eritrean forces then reportedly withdrew overnight on 07–08 October under persistent Ethiopian National Defense Forces (ENDF) drone attacks. Global Guardian was unable to independently verify the claimed withdrawal. The tentative Eritrean incursion follows a series of ENDF victories that not only rolled back initial EPFAS gains, but resulted in the capture of Mekele, Tigray’s regional capital.

Fighting between rebel and federal forces continued on 07 October in the Tselimoy area near the Tekeze River, and in Aguela, just north of Mekele along the key A2 corridor. Since abandoning Mekele to approaching ENDF ground forces, the TPLF’s military wing, the Tigray Defense Forces (TDF), has taken up defensive positions in the mountainous terrain to the west and north of Mekele. ENDF drone strikes have clustered around the towns of Werqamba and Enticho where TPLF leadership is likely to have relocated.

Background

The TPLF dominated Ethiopia’s government for three decades from 1991 to 2018 when widespread protests led to their ouster and the installment of current Prime Minister Abiy Ahmed. Overlapping inter-regional and political tensions, particularly around the contested western Tigray territory, led to the first Tigray war from 2020 to 2022, which killed between 400,000 and 800,000 people and displaced hundreds of thousands of others. In that war, Eritrea fought alongside Ethiopia’s federal government against the TPLF, which Eritrea has viewed antagonistically since the latter’s independence from then-TPLF-led Ethiopia in 1993. However, the alliance between Addis Ababa and Asmara soured following the 2022 Pretoria Peace Agreement as Prime Minister Abiy Ahmed made repeated claims of Ethiopia’s right to sovereign sea access through Eritrea’s port of Assab.

As described in our March Risk Barometer, the TPLF and Eritrea have since drifted into an alliance of convenience that was extended on 20 September 2026 to include the Amhara Fano National Movement (AFNM), Oromo Liberation Army (OLA), the Ogaden National Liberation Front (ONLF), the Afar Revolutionary Democratic Unity Front (Ugugumo), the Benishangul Peoples’ Liberation Movement (BPLM), and the Gumuz Peoples’ Democratic Movement (GPDM) as part of the EPFAS coalition. While these groups are aligned in their opposition to the current federal government, the coalition shares no common vision for Ethiopia’s future, and its members, in many cases, harbor deep enmity and historic grievances against their allies.

• 01 August: The Ethiopian army and TPLF forces clashed near the Sudan border.
• 20 September: Seven armed opposition groups, including the TPLF, Amhara Fano National Movement, and the Oromo Liberation Army, announced an “Alliance for Survival” to remove Prime Minister Abiy Ahmed.
• 23 September: TPLF-led forces seized the Mekele, Axum, and Shire airports. Ethiopian Airlines canceled flights to Tigray. The government called it an “all-out offensive.” Fighting spread into Afar and Amhara, and an estimated 150,000 people were displaced in Afar in the first week.
• 27 September–1 October: Rebels struck federal air facilities including Semera, Kombolucha, and the Harar Meda air base near Bishoftu. Explosions were heard in Addis Ababa overnight on 30 September–1 October, and an opposition-linked source claimed drone strikes on the capital, including on military headquarters. The intelligence service banned drone flights over the capital.
• 01 October: Ethiopia and Eritrea severed diplomatic ties. Ten Eritrean diplomats were expelled from Addis Ababa. On the same day, Ethiopia announced plans to unilaterally withdraw more than 3,000 troops from Somalia. Mogadishu said it had not been informed.
• 03–04 October: Government-aligned forces entered Mekele unopposed, and the TPLF said it had “temporarily moved out” and would keep fighting from other positions.
• 05 October: Abiy, sworn in for a second term, renewed his call for Red Sea access.
• 07–08 October: Credible reports place Eritrean troops in northern Tigray. They withdrew to Eritrea under Ethiopian drone bombardment.
  

Analysis

United in Opposition

Federal Ethiopian forces and aligned regional paramilitaries, including the Tigray Peace Force (TPF), have been engaged in persistent fighting against armed opposition groups like the TDF and AFNM, in some cases, for years. The coalescence of these opposition groups into a coalition reflects a newfound urgency and opportunity in opposition to Abiy’s government rather than an actual alignment of long-term interests. As with Eritrea and the TPLF, which share decades of enmity, many of these groups have a history of fighting each other as much as they do the federal government. Aside from their common opposition to Abiy’s government, these groups share no vision for Ethiopia’s future. Amharan and Tigrayan opposition groups, for example, have engaged in reciprocal atrocities in years of fighting over control of the western Tigray territory, a fight that would almost certainly resume following a hypothetical victory over Addis Ababa. While the coalition is presented as a popular fight for survival in the face of a domineering federal government, the reality of the alliance is based more in convenience and power.

Regional Dynamics

Addis Ababa has repeatedly accused Eritrea, Sudan’s recognized government (commonly referred to as the SAF), and Egypt of supporting the various insurgencies in Ethiopia. Conversely, Egypt and the SAF have accused Ethiopia of supporting the Rapid Support Forces (RSF) in Sudan’s civil war, and Somalia has accused Ethiopia of supporting the independence bid of its breakaway Somaliland region. While Ethiopia is a key partner in Somalia’s fight against the Al Qaeda-affiliated insurgent group al-Shabaab, Addis Ababa’s support for the breakaway Somaliland region poses a threat to national integrity unacceptable to Mogadishu. Egypt and Sudan have an additional grievance against Addis Ababa in the form of the Millennium Renaissance Dam on the Nile River. The dam was constructed by Abiy’s government despite emphatic opposition from Cairo and Khartoum, which depend on the river for the overwhelming majority of their fresh water. The accusations of support for rebel groups on all sides are generally credible, and provide vectors for influence, leverage, and control. Given the links between belligerents in ongoing conflicts in Somalia, Sudan, and South Sudan, a growing conflict in Ethiopia could quickly merge with neighboring conflicts to form a singular conflagration across the Horn of Africa.

Middle powers in the Gulf and Levant have also involved themselves in the conflict through diplomatic and economic support and the provision of advanced weapons systems. Thus far in the conflict, Ethiopia’s use of drones sourced through the UAE has granted Addis Ababa a significant advantage over both its domestic enemies as well as Eritrean forces. The interests of Saudi Arabia, Egypt, the SAF, and Turkey are more aligned with the TPLF and Eritrea, while those of the UAE, RSF, and Israel are more aligned with the Ethiopian federal government. The Gulf governments and Egypt are more likely to influence the conflict through financing, arms, and diplomacy than direct intervention, but if the war reaches Eritrea’s coast, it would raise regional concerns for all the actors concerned with the security of Red Sea shipping, already imperiled by Houthi activity.

Looking Forward

A protracted, multi-front conflict with Eritrea and with the involvement of regional actors to varying degrees is likely. The TPLF’s move out of Mekele suggests a shift from conventional to mobile, small-unit tactics as part of a guerrilla campaign reminiscent of the first phase of the first Tigrayan war. In 2020–2022, this proved difficult for Addis Ababa to address and exacerbated violence against civilians that likely constituted crimes against humanity by both Eritrea and Ethiopia’s federal government. Fano, Afar, and other insurgent groups remain active and capable, and preventing a federal victory over their allies in Tigray is a vital interest for Eritrea.

Strikes or combat affecting Addis Ababa, such as the drone strikes conducted on 01 October, indicate that opposition forces, particularly the TPLF, see the nationalization of the conflict as essential to their potential success. Disruptions to normal life in Addis Ababa would undermine the Abiy government’s narrative that this war is a regional struggle with illegitimate actors. If Tigrayan forces continue to lose initiative on the ground, the TPLF and Eritrea may resort to intensified long-range attacks on Addis Ababa that could pose threats to Addis Ababa Bole International Airport (ADD). Even without strikes on the airport itself, travel disruptions in and out of Ethiopia are likely if drone attacks on the capital continue due to increased GPS jamming countermeasures.

Russia’s Growing Sabotage Campaign Threatens Baltics and Eastern Europe 

Russia is increasing the aggressiveness of its actions against private firms and organizations in Europe. This new, more intense phase of “active measures” or “hybrid warfare” has grave direct security implications for companies with assets, personnel, or operations in Europe involved in the supply of military or dual-use technologies to Ukraine. The risk also extends to any firm with a presence in Europe that relies on critical infrastructure, particularly those with intensive energy and/or logistical demands. Global Guardian assesses that Russia perceives the current geopolitical moment as a window of opportunity to drive divisions between Ukraine’s backers, increasing the likelihood of limited drone attacks against the electrical grid or defense manufacturing in the Baltic states, Poland, or other NATO countries bordering Ukraine in the short to near term.

Recommendations

• Global Guardian recommends that businesses with operations or facilities in Europe, particularly in Poland, Finland, Germany, Romania, or the Baltic states of Latvia, Lithuania, and Estonia, should assess their exposure to critical infrastructure failures and develop contingency plans.
  • Maintain half-full tanks in primary vehicles.
  • Create redundant communications procedures in case of telecommunication failures.
• Designate and mark onsite shelter-in-place areas. These should be interior spaces away from windows and roofs, ideally below ground and with water, first-aid supplies, and charged communications.
• Coordinate emergency response ahead of time with local authorities and landlords, and review insurance coverage for war, terrorism, and infrastructure-interruption exclusions, since these are often where claims fail.

Situation Report

On 07 October 2026, Danish intelligence issued a warning that Russia is entering into a much more aggressive stance targeting European companies involved in supplying Ukraine with weapons or dual-use goods. According to the Danish Security and Intelligence Service (PET), Russia assessed that its sabotage campaign on NATO territory up until last winter had been ineffective. Russian intelligence agencies then conducted planning operations this past spring that led to a heightened tempo of attacks over the summer. As fall progresses, the number and severity of the attacks in Europe are likely to continue to rise exponentially.

The Danish announcement was only the most recent of a string of warnings from European politicians and intelligence officials. On 17 September, Polish Prime Minister Donald Tusk said that intelligence assessments show “plans for hybrid strikes using drones and missiles against countries supporting Ukraine, including Poland.” The next day, French President Emmanuel Macron called Tusk’s warning “sound and well-documented,” before summoning party leaders and 2027 presidential candidates to discuss the growing threat from Russia.

On 05 October, Germany’s head of the BND foreign intelligence service, Martin Jaeger, warned that “Germany is at risk of being drawn into a violent conflict with Russia,” in reference to Russia’s increasing cadence of sabotage and hybrid attacks within Germany.

Punctuated by the attempted drone attack at Leipzig Airport in Germany on 04 August, Russian “hybrid” attacks have been ramping up concurrently with warnings from European leaders and spy chiefs.

Other prominent incidents include:

• 09–10 September 2025: Roughly 20 unarmed Russian drones entered Polish airspace before being shot down by NATO jets. Poland invoked Article 4, and the incident sparked the creation of NATO’s “Eastern Sentry” operation in Poland and the Baltics.
• 17 November 2025: An explosion damaged track on the Warsaw–Lublin railway, a key line carrying aid to Ukraine, and a second incident hit the same line. Poland’s prime minister blamed Russian intelligence, working through Ukrainian nationals.
• 14–15 August 2026: Three Latvian suspects commissioned by Russian intelligence attacked an Estonian factory making unmanned vehicles for Ukraine.
• 03 September 2026: Two Bulgarians were arrested in Munich after throwing incendiary devices at the headquarters of Rohde & Schwarz, a German defense contractor whose products include anti-drone jamming systems.

Analysis

Russia has historically taken bold action when it feels it has a limited window of opportunity to make significant gains. Both the partial and full-scale invasions of Ukraine reflect this tendency. Global Guardian assesses that Russia perceives the current geopolitical moment as a window of opportunity to drive divisions between Ukraine’s backers in an attempt to discredit Article 5 and dissuade further aid for Ukraine.

End of “Total Peace” Triggers Criminal Retaliation in Colombia 

On 21 September, gunmen from the Autodefensas Conquistadoras de la Sierra Nevada (ACSN) imposed a "paro armado" (armed strike) across Santa Marta, Colombia, in retaliation for the killing of the group's second-in-command in a government security operation. ACSN gunmen burned vehicles, fired on shops, and forced businesses, schools, and transportation services to close under threat of violence. President Abelardo de la Espriella's confrontational approach to organized crime is likely to result in more criminal retaliation, increasing risks for businesses and travelers in regions undergoing government security operations. 

Recommendations

• Organizations with operations in Colombia should update contingency plans for similar criminal responses to government security operations, which can include attacks using explosives, roadblocks, and targeting businesses.
• Travelers in the Santa Marta and Magdalena areas should use secure, low-profile transportation for essential movements.
• Monitor local media and official government channels for signs of government operations and possible criminal retaliatory responses.

Situation Report

• On 21 September, President Abelardo de la Espriella announced that security forces had killed José Luis Pérez Villanueva, alias "Cholo," the second-in-command of the Autodefensas Conquistadoras de la Sierra Nevada (ACSN), along with six other alleged ACSN members. The operation took place in a rural area of the Sierra Nevada region in Magdalena department.
• Hours after the operation, the ACSN released a public communication ordering a 48-hour "paro armado" (armed strike) across Santa Marta and demanding that businesses and shops remain closed. That evening, ACSN gunmen hijacked and burned vehicles in the streets and fired shots at stores and shops, demanding that owners close. Videos uploaded by the gunmen themselves spread panic among residents.
• In response, President de la Espriella ordered additional military and police deployments to restore control and personally traveled to Santa Marta, where he accompanied military patrols.
• On 22 and 23 September, many businesses and transportation services remained closed and residents stayed home out of fear, despite the increased security presence. Mayor Carlos Pinedo ordered the suspension of public schools in five Santa Marta neighborhoods.
• On 24 September, the ACSN released a follow-up public communication on their X page, announcing an end to the paro armado.
• Colombian security forces continue cleanup operations, arresting ACSN members in the region. No further ACSN retaliatory attacks have been recorded.

Analysis

Colombia’s security policy is undergoing a sharp reversal. Former President Gustavo Petro's "Total Peace" (Paz Total) policy sought to reduce violence through truces and negotiations with armed groups, which gave many groups space to consolidate territory, recruit members, and expand into new regions and economic markets. Newly elected de la Espriella, who took office in August, campaigned on a complete departure from the Paz Total, promising direct confrontation with armed groups.

The ACSN is the dominant criminal organization in the Sierra Nevada de Santa Marta region and the surrounding Magdalena coast, where it controls illicit economies including drug trafficking and extortion. Armed strikes are a tactic used by Colombian armed groups to signal their power over a civilian population and impose costs on the state by paralyzing communities and businesses at gunpoint. The ACSN's strike on 21 September was a direct retaliation for the death of a senior leader, “Cholo.” Other common retaliatory tactics include car bombs, drone-dropped improvised explosive devices, or targeted ambushes.

Looking Forward

Further criminal retaliation against government security operations is likely across Colombia over the near term as President de la Espriella delivers on his campaign promise to use state force against armed groups. Each security operation against a senior leader, whether successful or not, gives the targeted group a reason to respond with a show of force. Criminal retaliations can take the form of paros armados, as seen in Santa Marta, or targeted explosive attacks and ambushes against security force installations. 

CUSTOM INTELLIGENCE